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(S//REL) 

Resources 
Expended 
Towards 
Response to 

Attacks 

(S//REL) Personnel, 
Network, Logistics 
Data, Compromises 



At least +30,000 lncidents/+500 Significant Intrusions 
in DoD Systems 

At least +1600 Network Computers Penetrated 
At least 600,00 User Accounts Compromised 
+ $100 Million to Assess Damage, Rebuild Networks 

USPACOM: Air Refueling Schedules (CORONET) 
USTRANSCOM: Single Mobility System (SMS) 

U.S. Air Force: 33,000 General/Field 
Grade Officer Records 

Navy: Over 300,00 User ID/Passwords Compromised 
Navy: Missile Navigation and Tracking Systems 
Navy: Nuclear Submarine/Anti-Air Missile Designs 



International Traffic and Arms Restrictions (ITAR) Data 
Contractor Research & Development 
Defense Industrial Espionage 

-B2, F-22, F— 3 5 , Space-Based Laser, Others 




(S//REL) Science & 
Technology 
Export Controlled 
Data 



/REL) Estimated Equivalent of Five Libraries of Congr 

(50 Terabytes) 
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SIGINT Discovers 
Adversary Tools 



How do we do this? 



SIGINT-Enabled Countermeasure | n 
Mitigates Adversary Intrusion 
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Adversary Malware 
Deployment /Attack Process 



Tailored Countermeasure 
Developed & Deployed 



SIGINT Discovers 
Adversary Intentions 



Countermeasure Development 



(S//REL) How do we use SIGINT to discover Malware during the 

design process? 
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